Disable Kernel iwlwifi Module
Ensures the iwlwifi Intel wireless kernel module cannot be loaded, keeping the Wi-Fi driver off on systems where wireless must be disabled.
Checked against the resolved running state (e.g. sshd -T, sysctl, systemctl show), catches drop-ins and Includes a file read would miss. Caveat: runtime ≠ persistence; a value correct now may not survive a reboot.
Why this rule matters
iwlwifi is the core driver for Intel Wireless Wi-Fi adapters. On servers and other systems where wireless networking must be off, an active Wi-Fi stack is an unmanaged network path that can bypass perimeter firewalls and adds driver code that parses untrusted radio frames. Preventing the kernel from loading iwlwifi provides an additional safeguard against accidental or malicious activation of wireless connectivity, beyond merely turning the radio off in software.
What Pavois checks
Pavois uses the InSpec kernel_module('iwlwifi') resource to confirm the module is not loaded and is disabled (blacklist plus an install ... /bin/true override). This reads the effective kernel state via lsmod and modprobe --showconfig, not just a config-file grep, so a drop-in or hardware-triggered autoload that re-enables wireless is detected.
describe kernel_module('iwlwifi') do
it { should_not be_loaded }
it { should be_disabled }
endHow to verify it is applied
Run modprobe -n -v iwlwifi, it should print install /bin/true. Confirm it is not loaded with lsmod | grep iwlwifi (no output expected). modprobe --showconfig | grep iwlwifi should show a blacklist iwlwifi and an install iwlwifi /bin/true line.
Inspect & investigate
Load attempts and hardware detection appear in the kernel ring buffer: dmesg | grep iwlwifi or journalctl -k | grep iwlwifi. The effective modprobe policy is shown by modprobe --showconfig | grep iwlwifi.
Remediation
pavois harden apply uses the kernel_module resource to blacklist iwlwifi: it writes a drop-in under /etc/modprobe.d/ with blacklist iwlwifi and install iwlwifi /bin/true, and unloads the module if loaded. Because the wireless stack may already be active, reboot_required is true to guarantee a clean state. Note iwlwifi is the base for iwlmvm, so blacklisting it removes the whole Intel Wi-Fi stack.
Pavois applies this with its own harden engine, the plan below, not a shell script:
| action | blacklist |
|---|---|
| name | iwlwifi |
| reboot_required | true |
| resource | kernel_module |
pavois harden plan localwhere the target is local, a user@host SSH alias, or a container , Docs
Impact & precautions
Risk if not applied: Wi-Fi can be brought up on a host that should be wired-only, opening an unmanaged network path and exposing radio-frame parsing code.
- Do not apply on laptops or any host that legitimately relies on Intel Wi-Fi, blacklisting
iwlwifidisables all Intel wireless networking and could cut off a remote machine with no wired connectivity. - Verify a working wired/management path before applying.
- A reboot is required for full effect; schedule it in a maintenance window.